p

p, 3 months ago

@graf @p @sjw @Moon

> somebody introduced a backdoor into xz/xz-utils (debian/ubuntu) via systemd and openssh

Holy fucking shit. Everyone always calls me crazy when I blow off new meme formats but shit like this happens way less frequently in older projects: bugs have been worked out, the formats are stable, and someone that has been running a project for 20 years is less likely to let dumb shit like this happen. (I have updated libwebp but I still have image.webp.enabled=false in Firefox.) A new stupid thing happens, it's all "CHANGE TO THIS NEW RETARDED FORMAT NOW" and almost overnight, everyone's distributing their tarballs in .xz.

Checked systems, not running 5.6.{0,1} on anything, luckily. Also I have posted this before but here it is again: https://www.nongnu.org/lzip/xz_inadequate.html .

> (openrc chads stay winning)

Speaking of using shit that has been reliable for 30 years, all of my Linux machines still use sysvinit. It's not just easier to deal with than systemd, it is actually faster: for the cost of the increased complexity (which everyone said would create security issues, and it has produced a constant stream of CVEs), systemd doesn't seem to deliver on any of its promises.

Imagine using systemd

> github.com/tukaani-project/xz/commit/af071ef7702debef4f1d324616a0137a5001c14c

Goddamn idiot Github has taken the repo down so people in those threads post things like "Hey, here's the commit!" and "Look at this line!" and it 404s. (Luckily found repo mirrors.)

> openwall.com/lists/oss-security/2024/03/29/4

It is actually really clever to put this into an m4 script. I bet most audits completely ignore it, and I am certain that almost no contributors ever read it: you say "m4" and people either don't know what it is or they knee-jerk "m4 sucks!" because typically the only exposure people have to it is the GNU-style m4 in autotools. autotools is a real shitshow in general, editing the .ac and .in files is something people dread doing, they're ugly and finicky, you could probably get patches through that people merge without reading if you just put something like "fix ./configure on netbsd". If he'd been stealthier with it, maybe it wouldn't have been found for years. (This is almost more of a vulnerability in autotools than in xz: code nobody ever reads is a liability.)

The analysis in oss-security is really fascinating stuff. Probably worth reading but the punchline is that it only ends up getting compiled in if it detects that a .deb/.rpm is being built, and even when compiled it, it triggers only under very specific circumstances, has some kinda minimal bits to avoid being detected, and eventually hooks into RSA_public_decrypt.

p, 3 months ago

@graf @p @sjw @Moon

> only systemd rolling release basically thats effected (so arch and similar).

Doesn't get compiled in on Arch, it tries to detect .deb/.rpm build processes and only compiles if that stuff's present. Apparently it made it into Debian, wouldn't be surprised if it hit Fedora or similar.

p, 3 months ago

@sjw @p @graf @yockeypuck @Moon LFS is even better for that. (And of course, there's CRUX.)

p, 3 months ago

@udongle @p @sjw @matty @tyler @graf @Moon Yeah, no backdoors in Microsoft/Apple products.

p, 3 months ago

@Humpleupagus @Fiddle I can't find the thing I was looking for but it was also not as good as this image:

p, 3 months ago

@kroner @MMS21 @arisudotexe @Sui @Tadano

> "pediverse" instances (yes, this is actually a thing) are being monitored/infiltrated by feds

Fear of that scenario is why most of those instances have registrations closed or invite-only, they've got the entire API locked down from the outside, and they instance-block or quarantine FSE/ryona.agency/cum.salon and a handful of other instances have threatened to do (or have actually done) something that compromises their secrecy or that draws unwanted attention (feds, hosting companies, other service providers).

It seems to me that the best way for them to maintain secrecy would be to not shove secrets onto the fediverse dot com, or at the very least to do whitelist federation with instances that are not actively hostile to their presence (for legal reasons) or continued existence (for obvious reasons), since they'd create no problems for fedi if they avoided fedi. Why most of them insist on sticking around is a mystery. Some of them are explicitly interested in "activism" and a lot of them test out tactics here, so they can use them on Twitter. (They write these "debate scripts" to give to people so that they can just spam arguments at people without having to think.) It's probably best not to help them out with their process of figuring out what works and just ice their accounts locally or, better yet, give them a reason to stay away from your instance. Some of them are probably feds; one of the hentai.baby users claims to be a fed that used to track down pedos on the internet but is now a pedo on the internet, but whether or not that's true, it would be surprising if none of them actually were feds, which would be a reason for them to stick around. Some of them are groomers and they're here to find others like them or because there are kids on fedi.

Without knowing why they're here, it's difficult to get them to leave. The "activists" aren't going to be deterred by woodchipper memes, because that's what they signed up for: you have to do something that compromises them or their servers, or something that disrupts what they are trying to do. Individual instances have done this and it's gotten them blocked/quarantined/etc., and I suspect that if more people were coming up with new and exciting ways to make pedos shit their pants, we'd hit the threshold where the "activist" chomos fuck off from fedi. The same thing handles the people that are here to find likeminded individuals or trying to get access to children; the ones that are looking for other groomers are actually helped by the woodchipper memes, because it makes it easier for other groomers to find them. (So the groomers and "activists" tend to provoke people.) The feds are doing god-knows-what, and good luck getting them to leave. As for the ones with unclear motivations, it's hard to stop them from doing what they're trying to do if you don't know what they're trying to do.

Here's an interesting case study: berries.space freaked out and wiped their entire instance when the Archive Team started archiving them. While ostensibly created by adults that wanted to make a safe space for LGBT kids, they went out of their way to attract preteens and encourage them to freely express their sexuality. The adults running berries.space took to their alts on mastodon.social or another single-user instance to decry archiving and declaring it extremely harmful due to the possibility that some of the kids' parents would find the archive and then kick little kids out of the house for being gay (an argument that worshippers of that particular sacred cow were eager to eat up). In reality, this was done to get enough of a social backlash against the Archive Team so that they would delete the evidence (which they did), and secondarily to act as a smokescreen to drown out the people that were asking things like "Why does the berries.space public timeline have a 12-year-old posting a photo of herself in her underwear accompanied by text saying she's 'bored'?" or "If that's public scope there, what is going on in less visible places?" Since they were "protecting" (or "exploiting", whichever) trans kids, and since that is an inviolable sacred cow on Canceldon, this actually got the Masto crowd to join in and help shut down questions about berries.space and the real reason the archive was considered dangerous. (So not only were they sexually exploiting children, but they ended their run by exploiting those same children as a shield against criticism.) They had already announced that they would be shutting down (word on the street is that this was also due to unwanted scrutiny), but the thing that got them to immediately delete everything (including the single-user instance) and run away screaming was the prospect that what they had done would be made public in a way that they could not control, something that (rightly) terrifies the shit out of someone that is openly flirting with children and building a collection of child pornography. (Likewise, the thing that got most of those instances to run screaming from FSE was a rumor that we were turning pedo instances' private posts and DMs public when they arrived on FSE, and after mint threatened to write an MRF that did that, they all blocked any instance he ever touched. Maybe I write MRF.SunlightPolicy and post it in threads where the pedos show up: if any instance anywhere could very easily be doing that sort of thing without having to write it themselves, pedo instances would have to start being extremely cautious.)

p, 3 months ago

@nhk @Tadano @Sui @degen @MMS21 @kroner @arisudotexe Please do clarify.

p, 3 months ago

@nhk @Tadano @Sui @degen @MMS21 @kroner @arisudotexe

> im being meta-ironic

That is not real.

> i interact with them constantly

Not recommended.

do_you_regret_killing_jeff_dourcet.mp4

p, 3 months ago

@nhk @Tadano @Sui @degen @MMS21 @kroner @arisudotexe Are you genuinely unable to distinguish between people with terrible political opinions and people that prey on children and upload shit to fedi that actually endangers the person operating the server, and not in a vague "mean words cause harm" way but domains getting revoked and equipment getting seized and people getting arrested?

Nobody is that fucking obtuse. If you have a point you want to make, spit it out.

p, 3 months ago

@Sui @Tadano @nhk @MMS21 @kroner @arisudotexe

> work camps or an excessive drain on taxes.

The ones that pick fights with fedi over whether or not it's reasonable to fire a pedophile from a daycare center after finding out that they're diddlers? I think most people would volunteer for gulag roundup duty immediately, for free just for those guys. Once they find out that it includes the people that bother actual kids on fedi or that upload CP, you will have fistfights breaking out in the parking lot over who gets to drive the black vans.

p, 3 months ago

@PurpCat @Tadano @nhk @Sui @degen @MMS21 @kroner @arisudotexe

> one slip of the mouse away from accidentally doing it to a public site.

Ignore deletes and you will see them occasionally post it with public scope instead of followers-only.

p, 3 months ago

@Hoss @Tadano @PurpCat @nhk @Sui @degen @MMS21 @kroner @arisudotexe Well, the one reasonable one I mentioned, he acknowledges that it's a problem, he doesn't talk about it like it's a great thing, and doesn't post photos of kids or post about wanting to fuck kids.

But then you have people like this:

hollyfuckskids1.png
hollyfuckskids2.png

p, 3 months ago

@graf @Tadano @PurpCat @nhk @Sui @degen @MMS21 @kroner @Hoss @arisudotexe Death is too merciful.

p, 3 months ago

@PurpCat @Tadano @nhk @Sui @degen @MMS21 @kroner @Hoss @arisudotexe I don't know who that guy is, but holy shit.

p, 3 months ago

@PurpCat @Tadano @nhk @Sui @degen @MMS21 @kroner @Hoss @arisudotexe I still don't know who he is or what is a MrBeast. (This is fine; I probably don't need to. Feel free to disregard this message unless you have reason to believe that I do need to know who he is. I don't intend to make you do DDG's job, I am just remarking that I do not know who he is.)

p, 3 months ago

@Sui @Tadano @PurpCat @nhk @MMS21 @kroner @Hoss @arisudotexe The name made me think of Mr. Hands.

p, 3 months ago

@graf @pasture @RustyCrab Yeah, I remember that; I dug the IP out of Poast's logs, it was her residential net connection, and grabbed a list of the things she'd been searching for, but I didn't get very far past that. I remember you sending the link when they figured out exactly who she was, though I don't know how they got there.

p, 3 months ago

@Moon :bigbosssalute: Godspeed.

p, 3 months ago

@Moon bloat buries a lot of the latency, but a handful of threads take a while to load.

p, 3 months ago

@Terry @sjw @comradepond @graf Not this goddamn horseshit again. Nobody born after 1990 knows how to verify primary source, they just know charge they phone, be video, eat psyop, and fail to read any words but just watch videos.

Lemme just go ahead and tag everyone that reposted this: @McMongoose @Xenomorph @Gundog @Heil_Honkler @IAMAL_PHARIUS @Chineseman @lichelordgodfrey @professionalbigot69 @sargoysmuck @SuperSnekFriend @wishgranter14 @Wolffkran . Then, to keep it under 16 people tagged, I'll just take out the National Just Podcasts guy, because he is an idiot.

I already discussed SB-686 April of last year. The short version is that anyone panicking about it right now is either unable to read the text of the bill ( https://www.congress.gov/bill/118th-congress/senate-bill/686/text?format=txt&r=15&s=1 ) or they are shills.

Here is my commentary from last time, plop it into the search box on your instance, you will see it if it federated: https://freespeechextremist.com/objects/5f4bf372-9f53-4c3c-89f1-748f5989958d . For your convenience, while checking that the post did indeed federate everywhere, I kept the links and have dumped them here.

Here it is on bae.st: https://bae.st/notice/AUEfCTACQQixOlezyK

Here it is on SPC: https://shitposter.club/AUEfCoFTsulzO2kSPI

Here it is on Poast: https://poa.st/notice/AUEfCjyNXcOE4ejcQ4

As far as this time goes, here is a piece of advice: the consistent stream of low-quality lies pouring out of TikTok mean that if there is anything important going on and someone posts a goddamn TikeToke at you, the only rational course of action is rape correction. Do you want the rape correction, Terry?

This round of TakTak is even fucking dumber than last time:

> See Tiktok video
> Some guy is hand-wringing over some bill before the Senate
> Ha, that reminds me of when they were shitting themselves over that other bill.
> Tiktok promotes content that is in Tiktok's interest, so they do not mind nudging bullshit to the top of the list.
> They are shitting themselves over SB-686
> It's the same shit
> It's the same style but this time it is some "Hey, fello teenagers" guy with a backwards baseball cap instead of some bearded fatty
> He's just reading random definitions from the bill.

I remember this from last time. It's the same shit as last time. It's retarded.

> Reads the "criminal penalties" section
> "A person that willfully commits [...] an unlawful act described in subsection (a)"
> "THIS MEANS THAT IF YOU USE A VPN TO LOOK AT TIKTOK YOU WILL GO TO JAIL"
> That is not a violation of subsection (a)

The only way to violate subsection (a) is to own a service or sell a product as part of a business that operates under the jurisdiction of a "foreign adversary" and has more than 1m users/customers in the US, or to do things like attempt to conceal that you are a Chinese company by using cutouts, which Chinese companies have been doing since forever, and which all of that "attempts to circumvent" stuff is about. See attached.

YOU CANNOT VIOLATE THIS ACT AS A PRIVATE US CITIZEN JUST BY USING A VPN TO LOOK AT TIKTOK

THAT IS GODDAMN RETARDED

THE BILL MENTIONING VPNs DOES NOT MEAN VPNs ARE ILLEGAL

HE HAS COMPLETELY FABRICATED THE "if you knowingly did so to access banned content" SHIT BECAUSE APPARENTLY THE CCP SENDS HIM SCRIPTS OR SOMETHING

HE GOES ALL THE WAY OFF THE FUCKING RAILS WITH THE SURVEILLANCE BULLSHIT

THERE IS ALL KINDS OF AWFUL SURVEILLANCE BULLSHIT, BUT YOU ARE NOT A COVERED ENTITY

UNLESS INSTAGRAM IS SOLD TO CHINA, HE IS FULL OF SHIT ABOUT THAT PART, TOO

HE CLOSES WITH "It really is that bad and I am not speaking in hyperbole" AND IF HE ACTUALLY BELIEVED THAT IT WAS AS BAD AS HE SAYS, THEN HE WOULD HAVE READ THE BILL.

IF YOU LISTEN TO ANYTHING THIS GUY SAYS AFTER THIS VIDEO, GIVEN HOW COMPLETELY FULL OF SHIT HE IS ON THIS POINT, THEN YOU ARE FUCKING RETARDED.

> Everyone freaking out about it this time is worse than the people that freaked out about it last time because it is the same nothingburger as last time

I could dig up my old posts about this when everyone was freaking out last time, or you could go to https://www.congress.gov/bill/118th-congress/senate-bill/686/text?s=1&r=15 and look at section 3, "ADDRESSING INFORMATION AND COMMUNICATION TECHNOLOGY PRODUCTS AND SERVICES THAT POSE UNDUE OR UNACCEPTABLE RISK" and read it. That section is where the meat is, the rest is just scaffolding: definitions (which do not matter out of context, like this dipshit reading off definitions; it's just a list of products that are covered), penalties, etc., might sound scary out of context but that is why they are being read out of context. This bill doesn't even ban Tiktok, it literally just gives Commerce the authority to evaluate and possibly veto some transactions

EVERYONE WHO GETS NEWS ABOUT THE LAW BY WATCHING A VIDEO ON TIKTOK GETS WHAT THEY FUCKING DESERVE

NOT ONLY IS TRUSTING TIKTOK TO TELL YOU THE TRUTH ABOUT ANYTHING THAT MIGHT AFFECT THE PEOPLE'S REPUBLIC OF CHINA EXACTLY LIKE TRUSTING THE NEW YORK TIMES TO TELL YOU THE TRUTH ABOUT THE CIA OR TRUSTING RT TO GIVE YOU THE TRUTH ABOUT PUTIN, IT IS A GODDAMN VIDEO AND I HATE SITTING THROUGH THIS SHIT

FOR EVERY PERSON THAT STIRS UP A PANIC ABOUT THIS SHIT WITHOUT ACTUALLY LOOKING TO SEE IF IT IS COMPLETE HORSESHIT, I WILL BASH A FOLDING CHAIR OVER THAT PERSON'S HEAD WHILE THE REF ISN'T LOOKING :randysavage:

p, 3 months ago

@graf @Terry @sjw @comradepond @randbot It doesn't even ban TikTok.

p, 3 months ago

@TheMadPirate @Terry @sjw @comradepond @graf @randbot I'm making a list of all of you fuckers that fell for this retarded psyop.

p, 3 months ago

@TheMadPirate @Terry @sjw @ChiRho @comradepond @graf @randbot

p, 3 months ago

@M_39 @Terry @sjw @comradepond @graf @randbot @mischievoustomato

p, 3 months ago

@mage @Terry @sjw @comradepond @graf @randbot This is why Terry should have read the bill before trying to panic everyone about the Russian pee tape.

p, 3 months ago

@PurpCat @Terry @sjw @comradepond @graf @randbot

> s686 didn't go anywhere unlike this

THIS IS SENATE BILL 686.

p, 3 months ago

@AGARTHA_NOBLE @Terry @sjw @comradepond @graf @randbot

p, 3 months ago

@IAMAL_PHARIUS @Terry @sjw @comradepond @graf @randbot GODDAMMIT HOW MANY PEOPLE FELL FOR THIS

p, 3 months ago

@sjw @Terry @comradepond @graf @randbot I can't see that one because of dav1d probably or something.

p, 3 months ago

@sjw @Terry @TheMadPirate @comradepond @graf @randbot That one is probably funny.

p, 3 months ago

@Terry @Chineseman @Gundog @Heil_Honkler @IAMAL_PHARIUS @McMongoose @SuperSnekFriend @Wolffkran @Xenomorph @comradepond @graf @lichelordgodfrey @professionalbigot69 @sargoysmuck @sjw @wishgranter14

p, 3 months ago

@dcc Oh, you need the filenames or have you downloaded them already?

p, 3 months ago

@dcc It relies on getting the JSON file and FSE's down.

p, 3 months ago

@Jonny @dcc He's secretly Chinese. We all are.

p, 3 months ago

@Jonny @dcc Do you know where I live, man?

p, 3 months ago

@Jonny @dcc

Marty Robbins - El Paso (Audio) [zWm5WErkffQ].webm

p, 3 months ago

@graf @Jonny @dcc Holy fuckin' shit, this is awesome.

I wonder why they used the picture of Marty Robbins for a Johnny Cash song, though.

p, 3 months ago

@graf @Jonny @dcc Anyway, my back's killing me, I gotta hit the couch a while.

p, 3 months ago

@graf @p @coolboymew HFS, nice.

p, 3 months ago

@icedquinn

p, 3 months ago

@sjw @p @p Lookit all those fuckin' pigeons, who parked that car under them?

p, 3 months ago

@RustyCrab @Vaghrad @cassidyclown @creamqueen @mint Why would they go rifle through all of his posts instead of sending an email?

p, 3 months ago

@RustyCrab @Vaghrad @cassidyclown @creamqueen @mint If this post sounds like I missed something, it's because rustc ate all of the RAM and angered Firefox and I'm typing from memory because Rust has the dumbest goddamn compiler and it shits crates into your home directory because it apparently hates when builds are self-contained because it is an idiot and I'm going to go throttle the team behind librsvg.

> Also somebody else probably scrubbed his timeline and sent it to them as a tip.

That's more plausible.

> a lot less effort than contacting somebody in Australia.

You keep saying that like it's more effort to email someone in Australia than it is to email someone locally.

> Also my friend involved in LE says police call people all the time. They come knocking if they can't get hold of you. It probably depends if they think you're a flight risk or a genuine threat.

I don't know the extent of your friend's involvement, but even local cops don't call if they have a problem with something you're doing, they just come find you. I've never seen them call to threaten someone, and I've never even heard of the Secret Service doing that.

But that's not the big deal. The point at which I said there's no chance they were the Secret Service was the weird internet-style threat. They don't just call and threaten you with various and sundry, not if they want to keep their jobs. If they're going to make a threat, it's not "We'll call your job and tell them you're being racist on the internet!", it's about maximum sentences and how, unlike states, federal sentences don't come with early parole. "We're gonna call your boss!" is something people say (or do) when they are mad at someone on the internet, the type of threat made by people that don't have the authority to get you arrested, and it's basically calculated to play directly into that specific worry. If a cop threatens to beat you up and steal your meth, is that guy probably an actual cop or a meth addict? (Hint: the real cop will just steal your meth and pretend he didn't see it.)

p, 3 months ago

@RustyCrab @Vaghrad @cassidyclown @creamqueen @mint

> on another note, police do go through social media feeds manually. They even have dedicated tools for it like this one https://www.hunch.ly/

Yes. I put in a bid with a company that was building one for ISIS Twitter accounts a long, long time back, when that kind of thing didn't make me projectile-vomit immediately. Then there's this company down in Orange County that uses Elixir to do automatic transcription and keyword search of phone calls made from prison: https://leotechnologies.com/careers/ . There are a million like this.

> Think about the average case police deal with.

Regular cops and the Secret Service are very different.

> I fail to see why there would be any need to waste resources contacting and waiting for facebook in a case like that.

Sure, that's local cops, though. They are investigating different things than the Secret Service and for different reasons and with different staff. The FBI is closer to local law enforcement than the Secret Service, but the FBI has a direct pipe, they just ask and receive.

p, 3 months ago

@RustyCrab @Vaghrad @cassidyclown @creamqueen @mint

> I am genuinely curious as to why, when provided with a link to a fedpost, you would be convinced that the agent would not do a basic sniff test and scroll for 5 minutes before wasting other people's time.

The difference is that I am not convinced it's plausible rather than that I am convinced it's implausible. The whole thing seems a little unlikely, but someone calling the secret service is more likely.

What I am convinced they would not do is call someone and say, "We're gonna call your employer and tell them you're super racist on the internet!" Presumably we'll find out soon enough from either the news or creamqueen.

p, 3 months ago

@Inginsub @Vaghrad @RustyCrab @cassidyclown @creamqueen @mint Presumably, if there was something someone knew that I didn't, they would have posted the link instead of arguing the point. I don't even know what thread it is.

p, 3 months ago

@RustyCrab @Vaghrad @cassidyclown @creamqueen @mint

> the point I'm stuck on

Not worth being stuck on something like that to the extent that you miss the actual point.

> on the other side of the world

DOES YOUR ISP CHARGE YOU FOR LONG-DISTANCE EMAILS